WIP: add security event evidence and redaction by bschnurr · Pull Request #8574 · microsoft/PTVS

bschnurr · 2026-07-07T16:52:14Z

No description provided.

azure-pipelines · 2026-07-07T16:52:22Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

- Use managed recursive delete with retries in FileUtils - Fallback to registry search for interpreter discovery in tests - Add async WaitAsync for process exit with timeout/cancel - Always set env vars in REPL; log spurious ERRE/DONE as warnings - Limit Python 2.x filtering to PythonCore entries - Clean up orphan registry keys in environment list tests - Make Django UI test assertions more robust to output changes - Update urls.py for Django 2.x+ compatibility with fallback

rchiodo · 2026-07-07T16:53:24Z

🔒 Automated review in progress — @rchiodo is auto-reviewing this PR.

sonarqubecloud · 2026-07-07T16:54:01Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

rchiodo · 2026-07-07T17:06:32Z

+            @"(?ix)(\b(?:password|passwd|pwd|token|access[_-]?token|refresh[_-]?token|secret|client[_-]?secret|api[_-]?key|subscription[_-]?key|credential|authorization|connection\s*string|connectionstring|sharedaccesssignature|sig|key)\b\s*[:=]\s*)(['""']?)([^'"";\s,&]+)(['""']?)",
+            RegexOptions.CultureInvariant
+        );
+


📍 Python/Product/Common/Infrastructure/SensitiveDataRedactor.cs:35
Verified security bypass (Skeptic executed the byte-identical Python twin; Advocate conceded). The SecretKeyValue pattern requires the keyword to be immediately followed by :/=, so quoted-key forms leak verbatim: {"password": "hunter2"}, {'api_key': 'plain-secret'}, and HTTP_AUTHORIZATION (the _ word char defeats \bAuthorization\b) all pass through unchanged. This is the dominant serialized-secret shape for the very sinks this control protects (WSGI environ, ex.ToString(), TaskDialog details), so the redactor silently leaks what it exists to stop. Allow an optional quote between key and separator (e.g. \b(?:...)\b['\"]?\s*[:=]\s*), match a leading quote on the key, and add regression cases for JSON, Python-dict-repr, and HTTP_* keys. The current tests only cover the bare key=/key: forms that already work, giving false confidence.

[verified]

rchiodo · 2026-07-07T17:06:36Z

+    r"\b(password|passwd|pwd|token|access[_-]?token|refresh[_-]?token|secret|client[_-]?secret|"
+    r"api[_-]?key|subscription[_-]?key|credential|authorization|connection\s*string|connectionstring|"
+    r"sharedaccesssignature|sig|key)\b(\s*[:=]\s*)(['\"]?)([^'\";\s,&]+)(['\"]?)",
+    re.I


📍 Python/Product/WFastCgi/wfastcgi.py:341
Same verified quoted-key bypass as the C# redactor (regexes are character-identical). Because environ is literally a dict and FastCGI logs frequently carry JSON/dict-repr, _sanitize_log_text will pass {"password": "..."} / HTTP_AUTHORIZATION straight into WSGI_LOG and AppInsights track_event. Fix the shared spec (optional quote before the separator; match leading key quote) and add the same regression cases here.

[verified]

rchiodo · 2026-07-07T17:06:39Z

+    }
+
    /// <summary>
    /// An exception that should not be silently handled and logged.


📍 Python/Product/Cookiecutter/Shared/Infrastructure/ExceptionExtensions.cs:62
Review-rule violation (reuse-core-utils): this private SensitiveDataRedactor is a character-for-character duplicate of Python/Product/Common/Infrastructure/SensitiveDataRedactor.cs (Architect verified byte-identical regexes via read_file). The using System.Text.RegularExpressions; added only for this copy signals the Common dependency was avoided rather than wired in. This copy is internal and untested, so it will inevitably drift from the Common one — any pattern fix (e.g. the quoted-key bypass) now has to land in three places across two languages. Remove this class and reference Microsoft.PythonTools.Infrastructure.SensitiveDataRedactor (link it as shared source or add a project reference to Common). Per the shared-review-policy hard gate, this stays an issue until the rule itself is amended.

[verified]

rchiodo · 2026-07-07T17:06:42Z

+            sanitized = SecretKeyValue.Replace(sanitized, match =>
+                match.Groups[1].Value + match.Groups[2].Value + RedactedValue + match.Groups[4].Value
+            );
+            return sanitized;


📍 Python/Product/Common/Infrastructure/SensitiveDataRedactor.cs:44
Verified partial leak: the value class [^'\";\s,&]+ stops at the first whitespace/comma, so any secret containing a space, comma, ;, &, or quote leaks its tail. Confirmed: password=my secret phrase → password=<redacted> secret phrase, token=a,b,c → token=<redacted>,b,c, and a connection string Server=x;Password=p@ss w0rd;... leaks w0rd. Passphrases and comma-joined token lists are realistic. For quoted values, consume to the closing quote instead of stopping at whitespace/comma.

[verified]

rchiodo · 2026-07-07T17:06:45Z

+            @"(?i)\b([a-z][a-z0-9+.-]*://)([^/\s:@]+(?::[^/\s@]*)?@)",
+            RegexOptions.CultureInvariant
+        );
+


📍 Python/Product/Common/Infrastructure/SensitiveDataRedactor.cs:30
Verified partial leak in UriUserInfo: the userinfo class [^/\s:@]*/[^/\s@]* stops at the first @, so a password containing @ (legal and common) partially leaks — https://user:p@ssword@host/path → https://<redacted>@ssword@host/path, leaving ssword@host. Consume up to the last @ before the authority instead.

[verified]

rchiodo · 2026-07-07T17:06:48Z

+            @"(?ix)(\b(?:password|passwd|pwd|token|access[_-]?token|refresh[_-]?token|secret|client[_-]?secret|api[_-]?key|subscription[_-]?key|credential|authorization|connection\s*string|connectionstring|sharedaccesssignature|sig|key)\b\s*[:=]\s*)(['""']?)([^'"";\s,&]+)(['""']?)",
+            RegexOptions.CultureInvariant
+        );
+


📍 Python/Product/Common/Infrastructure/SensitiveDataRedactor.cs:35
Verified over-redaction: the bare keywords key and sig are generic enough to mangle ordinary diagnostic text — Parsing failed at key: value in config → key: <redacted>, and the design sig = v2 → sig = <redacted>. This erodes the diagnostic value the evidence file claims to preserve. Consider dropping bare key/sig or requiring a tighter context (e.g. api_key, signing_sig). Note the current test deliberately encodes sig redaction as desired, so decide the intended behavior explicitly.

[verified]

rchiodo · 2026-07-07T17:06:51Z

+                match.Groups[1].Value + match.Groups[2].Value + RedactedValue + match.Groups[4].Value
+            );
+            return sanitized;
+        }


📍 Python/Product/Common/Infrastructure/SensitiveDataRedactor.cs:40
Architectural concern (Architect, structurally confirmed): redaction is applied by remembering to wrap each producer (TaskDialog, CustomCommand, ExceptionExtensions, wfastcgi.log) rather than at the logging-sink boundary. This makes coverage aspirational — any new logging call site silently bypasses redaction, which the evidence file already admits ("outside the covered redaction paths"). Consider redacting once where text enters the Trace/EventLog/ActivityLog/AppInsights writers so the guarantee becomes structural. Additionally, share a golden input/expected corpus between the C# and Python copies to enforce spec parity across languages.

[verified]

rchiodo · 2026-07-07T17:06:54Z

+// reloaded.
+_canExecute = false;
+```
+


📍 .github/compliance/evidence/reports/security/2984085-security-events-sensitive-errors-evidence-2026-07-03.md:91
Given the verified JSON/quoted-key bypass, the Evidence 3/4/5 "Control coverage: … avoids common secret-bearing key/value patterns" claims are overstated — they hold only for unquoted k=v/k: v, not the JSON/dict/HTTP_* forms these sinks most often carry. Temper this wording (or fix the redactor first) before this file is cited as coverage, so the compliance artifact doesn't create false confidence. The file's honest PARTIAL framing is otherwise good.

[verified]

rchiodo · 2026-07-07T17:06:58Z

+                best.Configuration.GetPrefixPath(),
+                best.Configuration.InterpreterPath
+            ) : null;
+        }


📍 Python/Product/Cookiecutter/Model/CookiecutterClientProvider.cs:79
Coupling concern (Architect): the new FindCompatibleInterpreterFromRegistry fallback is a production interpreter-selection branch added "for tests" (comment: "used when no IServiceProvider is available (for example, in unit tests)"). Test needs leaking into product code is a smell, and this path is now coupled to the sibling PythonRegistrySearch 2.x-filter change so they must move together. Consider injecting a test seam instead of branching production logic on the absence of a service provider. The compModel?.GetService null-guard added here is a genuine fix (removes a real NRE).

[verified]

rchiodo · 2026-07-07T17:07:01Z

+            var env = processInfo.Environment;
+            foreach (var kv in _serviceProvider.GetPythonToolsService().GetFullEnvironment(Configuration)) {
+                env[kv.Key] = kv.Value;
            }


📍 Python/Product/PythonTools/PythonTools/Repl/PythonInteractiveEvaluator.CommandProcessorThread.cs:104
Unexplained behavior change (Architect): removing the #if DEBUG / if (!debugMode) guard means debug builds now always apply the full environment via GetFullEnvironment, silently changing debug-build startup behavior. This is unrelated to redaction and undocumented in the diff. Add a rationale (or a separate PR) explaining why the debug-only carve-out is no longer needed.

[verified]

rchiodo · 2026-07-07T17:07:04Z

+            // Only filter Python 2.x for PythonCore-compatible entries.
+            // Custom configurable interpreters (e.g. company == "VisualStudio")
+            // may legitimately have no SysVersion set, and must not be filtered here.
+            if (pythonCoreCompatibility && sysVersion > new Version(0, 0) && sysVersion < new Version(3, 0)) {


📍 Python/Product/VSInterpreters/Interpreter/PythonRegistrySearch.cs:188
Behavior change riding a redaction PR (Advocate, Skeptic, Architect, all [unverified] runtime): the 2.x filter now only applies when pythonCoreCompatibility && sysVersion > (0,0), so PythonCore entries with a missing/unparseable SysVersion (previously defaulted to (0,0) and filtered out) now pass through. The change is narrowly guarded and the comment explains the intent (custom configurable interpreters), but it widens what surfaces and has no accompanying test in the diff. Add regression coverage for the missing-SysVersion case, or split this into its own PR.

[verified]

rchiodo · 2026-07-07T17:07:07Z

+        }
+
        /// <summary>
        /// Enables using 'await' on this object.


📍 Python/Product/Cookiecutter/Shared/Infrastructure/ProcessOutput.cs:741
No defect found — all three reviewers independently confirmed WaitAsync correctly closes the subscribe-after-exit race (_haveRaisedExitedEvent/HasExited recheck + idempotent TrySetResult), links cancellation with the delay CTS, cancels the delay timer on the exit-wins path, and unsubscribes in finally on every path. The only gap: this new non-trivial async primitive ships without a visible unit test in the diff ([unverified] whether coverage exists elsewhere). Add a targeted test for the timeout, cancellation, and already-exited paths.

[verified]

rchiodo · 2026-07-07T17:07:10Z

+
 def log(txt):
    """Logs messages to a log file if WSGI_LOG env var is defined."""
+    txt = _sanitize_log_text(txt)


📍 Python/Product/WFastCgi/wfastcgi.py:361
Scope/cohesion note (Advocate, Architect): beyond redaction, this PR carries ~8 independent changes (FileUtils managed-delete, WaitAsync, PythonRegistrySearch filter, REPL #if DEBUG removal, REPL Debug.Fail→Trace.TraceWarning, Django re_path compat, UIA fallback, EnvironmentList orphan cleanup). Each is individually defensible, but the bundle can't be reviewed or reverted selectively — if the redaction work needs rollback given the verified leak, it drags unrelated stabilization fixes with it. Recommend splitting into (1) redaction+evidence, (2) test-infra stabilization, (3) interpreter/registry behavior. The WIP: title is appropriate for now.

[verified]

rchiodo · 2026-07-07T17:07:14Z

Main blocker: the redaction regexes only match bare key=/key: v and miss the dominant serialized-secret shapes for these very sinks — JSON/dict-repr ({"password": "..."}), quoted keys, and HTTP_AUTHORIZATION (the _ defeats \bAuthorization\b). Fix the shared spec (allow an optional quote before the separator, match a leading key quote, handle HTTP_*) and add regression cases for those forms. Also de-duplicate the redactor into one shared implementation, and temper the evidence file's coverage claims accordingly. Secondary: several unrelated stabilization changes (WaitAsync, FileUtils delete, PythonRegistrySearch filter, REPL #if DEBUG removal) ride along without tests/rationale — consider splitting so the redaction work can be reverted independently if needed.

rchiodo · 2026-07-10T15:14:10Z

Main theme: the new SensitiveDataRedactor is the security-critical core of this PR, but its regex only handles bare key=v/key: v forms — verified bypasses leak {"password": "..."}/dict-repr and HTTP_AUTHORIZATION-style keys straight into logs (C# and Python copies are character-identical, so both leak). Please fix the shared spec, add JSON/dict/HTTP_* regression cases, and reconcile the compliance-evidence wording with the real coverage. Separately, this WIP bundles ~8 unrelated stabilization/behavior changes that would be easier to review and revert if split out.

bschnurr added 2 commits July 6, 2026 14:07

WIP: add security event evidence and redaction

e93c2eb

Make InstalledFactories use registry configs

3259ad3

bschnurr requested a review from a team as a code owner July 7, 2026 16:52

rchiodo reviewed Jul 7, 2026

View reviewed changes

Uh oh!

Conversation

bschnurr commented Jul 7, 2026

Uh oh!

azure-pipelines Bot commented Jul 7, 2026

Uh oh!

rchiodo commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sonarqubecloud Bot commented Jul 7, 2026

Quality Gate passed

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rchiodo commented Jul 7, 2026

Uh oh!

rchiodo commented Jul 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

rchiodo commented Jul 7, 2026 •

edited

Loading